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Abstract  -  Whether  by  nature  or  design,  the  personas  of 
terrorists  are  often  shrouded  in  mystery  until  they  commit  an  act 
on  the  international  stage.  Without  comment  on  the  ethical 
dilemma  that  some  identify  with  the  practice,  creating  a  profile  of 
a  terrorist  from  the  available  population  serves  as  a  starting  point 
to  reduce  the  volume  of  individuals  requiring  further  investigation 
by  limited  analytic  resources.  A  Terrorist  Identification 
Probabilistic  Ontology  can  assist  the  intelligence  community  in 
determining  the  likelihood  of  an  individual  being  involved  in 
terrorism  using  information  about  an  individual’s  relations,  group 
associations,  communications,  and  background  influences. 
Intelligence  analysts  may  use  the  proposed  decision  support 
system  to  identify  those  individuals  that  bear  further  scrutiny  and 
pose  a  risk  to  target  countries  or  their  interests.  Using  the 
Reference  Architecture  for  Probabilistic  Ontology  Development 
as  a  blueprint,  an  architecture  is  instantiated  to  develop  a 
Terrorist  Identification  Probabilistic  Ontology  used  for  decision 
support.  Ontologies  are  a  fundamental  enabling  technology  for 
system  interoperability.  They  provide  machine -interpre table 
representation  of  domain  semantics,  thus  allowing  interchange  of 
information  with  unambiguous,  shared  meaning.  However,  a 
fundamental  aspect  of  many  real-world  problems  is  uncertainty, 
which  traditional  ontologies  do  not  represent.  Representation  of 
uncertainty  in  real-world  problems  requires  probabilistic 
ontologies,  which  integrate  the  inferential  reasoning  power  of 
probabilistic  representations  with  the  first-order  expressivity  of 
ontologies.  The  Reference  Architecture  for  Probabilistic  Ontology 
Development  (RAPOD)  catalogues  and  defines  the  processes  and 
artifacts  necessary  for  the  development,  implementation  and 
evaluation  of  explicit,  logical  and  defensible  probabilistic 
ontologies  developed  for  knowledge -sharing  and  reuse  in  a  given 
domain.  This  paper  provides  an  example  implementation  of  the 
RAPOD  in  the  form  of  an  architecture  for  a  Terrorist 
Identification  Decision  Support  System. 

Keywords — probabilistic  ontology ,  terrorism ,  inferential 

reasoning ,  architecture 

I.  INTRODUCTION 

A.  Background 

Whether  by  nature  or  design,  the  personas  of  terrorists  are 
often  shrouded  in  mystery  until  they  commit  an  act  on  the 
international  stage.  A  decision  support  system(DSS)  that  draws 
upon  existing  reference  knowledge  coupled  with  current 
intelligence  information  can  aid  the  intelligence  analyst  by 
reducing  the  number  of  individuals  requiring  further 
investigation  by  limited  analytic  resources.  A  Terrorist 
Identification  Probabilistic  Ontology  (TIDPO)  can  provide  a 
means  to  capture  and  catalog  attributes  and  relationships  of 
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individuals,  allowing  probabilistic  inference  to  identify  suspects 
requiring  further  scrutiny.  Specifically,  the  TIDPO  can  assist  the 
intelligence  community  by  determining  the  likelihood  of  an 
individual  being  involved  in  terrorism  using  information  about 
this  person’s  relations,  group  associations,  communications,  and 
background  influences .  This  paper  introduces  an  architecture  for 
development  of  a  TIDPO  for  use  in  a  DSS. 

Ontologies  are  a  fundamental  enabling  technology  for 
system  interoperability.  They  provide  machine -interpretable 
representation  of  domain  semantics,  thus  allowing  interchange 
of  information  with  unambiguous,  shared  meaning.  However,  a 
fundamental  aspect  of  many  real-world  problems  is  uncertainty, 
which  traditional  ontologies  do  not  represent.  Therefore,  a 
means  to  incorporate  uncertainty  is  a  necessity.  Representation 
of  uncertainty  in  real-world  problems  requires  probabilistic 
ontologies  (PO),  which  integrate  the  inferential  reasoning  power 
of  probabilistic  representations  with  the  first-order  expressivity 
of  ontologies.  Probabilistic  ontologies  extend  current  ontology 
formalisms  to  provide  support  for  representing  and  reasoning 
with  uncertainty. 

Using  the  Reference  Architecture  for  Probabilistic  Ontology 
Development  (RAPOD)  [1]  as  a  blueprint,  the  TIDPO 
Architecture  is  instantiated  to  develop  a  probabilistic  ontology 
used  for  decision  support.  The  architecture  provides  synergy  of 
effort  by  identifying  concepts,  processes,  languages,  and  tools 
for  designing  and  maintaining  the  TIDPO.  It  details  each  of  the 
components  and  defines  the  criteria  to  be  satisfied  by  the 
selected  tools  and  methods.  Further,  this  architecture  may  be 
used  to  develop  similar  probabilistic  ontologies  for  decision 
support  in  similar  domains. 

B.  Scope 

Terrorists  maintain  an  unremarkable  profile  and  utilize 
advanced  social  networking  communications  techniques  to 
minimize  the  likelihood  that  they  are  detected  before  executing 
planned  attacks.  Extending  the  model  introduced  in  [2],  the  PO 
conceptualized  in  this  paper  is  applicable  to  terrorists  that  target 
the  West  as  identified  by  Sageman  [3].  Terrorists  are  commonly 
identified  as  multinational  and  transient,  compounding  factors 
in  identifying  potential  terrorists  from  the  multitude  of  persons 
that  interact  with  U.S.  interests,  at  home  and  abroad.  However, 
using  information  about  an  individual’s  relations,  group 
associations,  communications,  and  background  influences  may 
provide  insight  into  the  likelihood  of  a  person  being  involved  in 
terrorism  While  some  affiliations  may  increase  the  likelihood 


that  an  individual  may  join  a  terrorist  group  and  attempt  access 
to  a  target  country,  there  is  always  the  uncertainty  that  comes 
from  the  human  condition.  Further,  each  individual  may 
participate  in  multiple  organizations  (some  of  which  may  be 
as  sociated  with  terrorism)  or  have  multiple  friends  and  relatives 
(some  of  whom  may  participate  in  terrorism).  Uncertainty 
associated  with  the  multitude  of  factors  affecting  the 
crewmember’s  context  must  be  captured  conditionally.  Without 
comment  on  the  ethical  dilemma  that  some  identify  with  the 
practice,  creating  a  profile  of  a  terrorist  from  available 
population  data  serves  as  a  starting  point  to  reduce  the  volume 
of  individuals  requiring  further  investigation  by  limited  analytic 
resources.  The  TIDPO  will  incorporate  domain  knowledge  and 
individual  attributes  to  infer  the  likelihood  an  individual  is 
involved  in  terrorism  and  therefore  bears  further  scrutiny. 

A  decision  support  system  is  an  interactive,  computer- 
based  information  systemthat  supports  business  or 
organizational  decision-making  activities  through  compilation, 
processing  and  display  of  domain  information.  Its  purpose  is  to 
assist  in  the  activity  of  decision  making  by  providing  an 
organized  set  of  tools  intended  to  impose  structure  on  portions 
of  the  situation  and  to  improve  the  ultimate  effectiveness  of  the 
decision  outcome  [4].  With  the  ever-increasing  volume  of 
information  delivered  to  the  analyst,  there  is  a  need  for  advanced 
decision  support  through  data  compilation,  screening, 
transformation  and  probabilistic  inference.  Input  may  include 
raw  data,  documents,  interviews,  and  mathematical  models 
stored  in  databases,  ontologies,  and  probabilistic  ontologies. 
Because  each  DSS  is  domain-specific,  it  has  a  narrow  focus  of 
applicability  and  will  only  address  anarrow  set  of  decisions.  In 
this  paper,  the  DSS  for  terrorist  identification  is  the  desired 
product  for  the  intelligence  analyst,  supported  through 
implementation  of  the  TIDPO  specified  in  the  architecture.  The 
TIDPO  will  be  populated  using  the  work  of  Marc  Sageman  [3] 
to  validate  the  model.  Incorporating  biographical  data  for  the 
172  terrorists  studied,  subsequent  work  will  test  the  PO  model 
against  the  911  terrorists  to  see  if  the  TIDPO  correctly  identifies 
the  perpetrators  as  needing  further  scrutiny. 

C.  Model  Implementation  and  Viewpoint 

The  concept  model  shown  in  Figure  1  illustrates  the  scope  of 
the  TIDPO  Architecture  supporting  the  Terrorist  Identification 
DSS  in  which  an  intelligence  analyst  is  aided  in  producing  a 
contextually  driven  decision.  The  DSS  is  updated  using 
available  data  regarding  the  current  operational  environment  and 
intelligence.  It  is  based  on  a  knowledge  base  and  supported  by  a 
PO  grounded  in  the  reference  environment.  The  architecture 
described  below  is  a  blueprint  for  development  of  the  TIDPO  to 
support  the  DSS. 

As  shown  in  the  figure,  an  ontology  of  relevant,  hierarchical 
relationships  among  terrorism-associated  classes  is  constructed. 
Then,  uncertainty  is  introduced  based  on  a  reference 
environment  representing  a  contextually  relevant  situation.  For 
example,  the  intelligence  analyst  may  be  interested  in  terrorism 
based  in  the  Arabian  Peninsula.  This  would  guide  queries  to  the 
Intelligence  Knowledge  Base  for  relevant  relationships. 
Evidence  from  the  available  knowledge  base  is  applied  to  the 
probabilistic  ontology  to  provide  the  DSS  with  inferential 


reasoning  support  that  is  tailored  for  the  chosen  operational 
domain.  After  implementation  and  during  operations,  the  DSS 
continually  receives  updated  information  about  the  current 
operational  situation  and  changes  to  the  environment.  These  data 
update  the  intelligence  knowledge  base,  and  therefore  the 
probabilistic  ontology.  The  end  result  is  a  DSS  that  produces 
contextually -driven  decisions  about  the  domain  of  interest  using 
both  historical  and  current  evidence. 


Figure  1  -  Concept  Diagram  for  T  errorist  Identification  DSS 

At  the  highest  level  of  abstraction,  the  TIDPO  architecture 
responds  to  a  requirement  for  decision  support  by  the 
Intelligence  Analyst.  Specifically,  it  describes  the  composition 
of  the  systemby  providing  determination  of  structural  elements, 
their  interfaces,  and  their  behavior  [5].  The  architecture  codifies 
captured  lessons  learned  and  best  practices,  acknowledges 
wisdom  and  presents  a  set  of  services,  design  concepts, 
components  and  configurations  applicable  to  the  specific 
domain  of  interest.  Creating  an  architecture  for  a  given  domain 
problem  results  in  a  reusable  blueprint  for  similar  designs  that 
facilitates  successful  development  from  conceptualization  to 
operation.  Using  the  RAPOD,  an  architecture  is  instantiated  for 
the  TIDPO,  illustrated  in  Figure  2  . 

II.  PROBABILIST  ic  Ont  ology  Archit  ect  ure  for  a 

Terrorist  Identification  Decision  Support  System 

The  PO  architecture  in  Figure  2  illustrates  the  TIDPO  from 
conceptualization  as  a  DSS  that  is  required  to  determine 
likelihood  of  terrorist  affiliation  to  the  operational 
implementation  of  a  PO  that  performs  inferential  reasoning  to 
support  that  requirement.  In  the  Input  Layer,  references  to 
appropriate  tables  detailed  below  lead  to  specification  of 
objectives,  requirements,  metrics  and  rules.  Similarly,  in  the 
Methodology  Layer  ontology  reuse,  the  Probabilistic  Ontology 
Development  Methodology  (PODM)  [6],  ontological 
engineering,  and  learning  are  linked  with  their  descriptions  in 
Section  II.B.  Neither  ontological  learning  nor  probabilistic 
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Figure  2  -  T  errorist  Identification  Probabilistic  Ontology  Architecture 


learning  is  used  for  this  instantiation.  A  database  of  172  known 
terrorists  was  constructed  as  the  knowledge  base,  which  captures 
multiple  attributes  for  each  individual.  Ontological  engineering 
is  performed  on  this  KB  to  create  the  Terrorist  Identification 
Ontology  in  Protege.  The  Support  Layer  consists  of 
technological  artifacts  highlighted  by  the  OWL  and  MEBN 
languages  used  to  represent  the  ontology  and  probabilistic 
ontology,  respectively.  Software  included  Protege  for  ontology 
modeling  and  UnBBayes  for  probabilistic  ontology  modeling. 
Finally,  the  research  of  Marc  Sageman  is  used  to  generate  the 
Terrorist  Database.  From  this  blueprint,  the  TIDPO  will  be 
developed  using  the  PODM  specified  in  [6].The  TIDPO  is 
created  by  ingesting  Terrorist  Identification  Ontology  and 
incorporating  uncertainty  in  MEBN  using  UnBBayes.  A 
probabilistic  ontology  provides  a  means  to  represent  and  reason 
with  uncertainty  by  integrating  the  inferential  reasoning  power 
of  probabilistic  languages  with  the  first-order  expressivity  of 
ontologies.  Few  things  are  certain,  and  inferring  in  the  presence 
of  uncertainty  allows  the  analyst  to  focus  attention  on  the  most 
relevant  data  through  designed  queries . 

A.  Input  Layer 

The  Input  Layer  defines  external  influences  on  the 
probabilistic  ontology  and  is  referenced  by  components  of  the 
Methodology  Layer.  It  contains  those  components  expected  to 
provide  detail  on  the  purpose  of  the  PO  and  its  bounding 
constraints  in  the  formof  systemrequirements.  Population  of  the 
Input  Layer  occurs  primarily  during  the  early  stages  of  the 
development  process  during  which  the  Stakeholder  and 
Developer  work  closely  to  identify  the  objective  of  the  model, 
expectations  of  its  performance,  and  resource  restrictions. 
Parameters  specified  in  the  Input  Layer  will  constrain  the 
operational  implementation. 


1)  Objective.  With  an  Intelligence  Analyst  stakeholder,  the 
objective  is  given  in  Table  1.  The  domain  for  this  instantiation 
of  the  TIDPO  is  Islamic  fanatics  of  the  global  Salafi  Jihad 
identified  by  Sageman  in  [3] . 


Objective 


Provide  decision  support  through  inferential 
reasoning  to  determine  the  likelihood  a  particular 
individual  is  a  terrorist  based  on  a  profile  of 
background,  relationships,  communications,  and 
associations. 


2)  Requirements.  Requirements  define  the  system  to  be 
implemented  in  terms  of  its  behaviors,  applications,  constraints, 
properties,  and  attributes.  Table  2  records  the  initial 
requirements  elicited  from  the  Stakeholder  through  an  iterative 
process  that  included  objective  setting,  background  knowledge 
acquisition,  knowledge  organization,  and  requirements 
collection  [7] . 


Table  2  -  Table  of  Selected  Requirements 


ID 

Requirement 

R1 

Determine  likelihood  individual  is  a  terrorist 

R2 

Background 

R2.1 

Ingest  knowledge  of  killed  i  n  OEF 

R2.2 

1  ngest  knowledge  of  i  mprisoned  i  n  OEF 

R2.3 

Ingest  familystatus 

R2.4 

Ingest  place  of  worship 

R2.5 

Ingest  former  military/police 

R2.6 

Ingest  government 

R3 

Relationships 

R3.1 

Ingest  family  involvement 

R3.2 

Ingest  friend  involvement 

R3.3 

Ingest  social  network  i  nformation 

R4 

Associations 

R4.1 

Ingest  nationality 

R4.2 

1  ngest  economic  standing 

R4.3 

Ingest  education  level 

R4.4 

Ingest  occupation 

R5 

Communications 

R5.1 

Ingest  cell  phone  use 

R5.2 

Ingest  email  use 

R5.3 

Ingestweblog  use 

R5.4 

Ingest  chat  room  use 

R6 

Performance 

R6.1 

Must  run  on  PC  computer 

R6.2 

Must  provide  solution  in  2  minutes 

The  goal  of  this  task  is  to  capture  attributes  that  should  be 
controlled  within  the  model  in  written  requirement  statements, 
to  be  validated  by  the  Stakeholder  and  measured  by  the  metrics. 
The  operational  PO  will  be  evaluated  against  these 
requirements . 

3)  Metrics.  Metrics  characterize  the  criteria  by  which  the 
fielded  system  is  to  be  evaluated.  For  the  TIDPO,  the  primary 
metric  of  interest  is  P(terrorist\background,  relationships, 
associations,  communications) ,  which  defines  model  accuracy. 
An  initial  set  of  metrics  based  on  the  requirements  is  captured  in 
Table  3.  It  is  best  if  there  is  at  least  one  metric  to  support  each 
requirement  of  the  system 

4)  Rules  and  Axioms.  Formal  Axioms  are  first-order  logical 
expressions  that  are  always  true.  Rules  are  used  to  infer 
attribute  values,  or  relation  instances  [8] .  The  Formal  Axioms 
and  Rules  Table  also  captures  heuristics  and  algorithms  that  act 
as  constraints  for  the  model.  Table  4  summarizes  selected 
Axioms  and  Rules  from  the  TIDPO. 

These  heuristics  and  algorithms  are  used  as  bounding 
constraints  to  scope  the  model  appropriately  for  the  domain  by 
capturing  plain -language  relationship  statements  in  machine - 
readable  format.  Relevant  heuristics  and  algorithms  are 
regarded  as  Axioms  which  are  propositions  assumed  without 
proof  for  the  sake  of  studying  the  consequences  that  follow 
from  it  [9]. 


B.  Methodology  Layer 

The  Methodology  Layer  contains  the  heart  of  the 
probabilistic  ontology  development  process  including  the 
Probabilistic  Ontology  Development  Methodology  that  allows 
creation  of  a  specific  probabilistic  ontology  implementation  to 
support  the  requirements  of  the  Stakeholder.  The  Methodology 
Layer  references  information  gathered  in  the  Input  Layer  and  is 
assembled  using  components  and  tools  from  the  Support  Layer. 
Its  individual  components  are  introduced  below. 

1)  Ontology  Reuse.  Before  beginning  construction  of  the 
ontology,  it  is  useful  to  research  existing  ontologies  in  related 
domains  to  be  reused  and/or  extended  for  the  current  problem 
Model  reuse  is  defined  as  the  process  by  which  available 
knowledge  is  used  as  input  to  generate  new  models.  Reusing 
existing  models  may  also  require  ontological  re-engineering  as 
described  by  Gomez-Perez  et  al.  [8].  For  the  Terrorist 
Identification  Ontology,  three  existing  ontologies  are  reused  by 
incorporating  applicable  classes  and  relations . 

2)  Probabilistic  Ontology  Development  Methodology. 
Extending  the  work  of  Carvalho  [27],  thePODM  completes  the 
evolution  of  requirements  into  an  ontology  that  is 
probabilistic  ally -integrated.  A  probabilistically-integrated 
ontology  combines  the  inferential  reasoning  power  of 
probabilistic  representations  with  the  first-order  expressivity  of 
ontologies.  A  key  component  of  that  methodology  is  a  detailed 
Construction  Process,  which  explicitly  describes  the  iterative 
tasks  required  to  produce  a  probabilistic  ontology  with  in -situ 
evaluation  steps  to  ensure  continuous  operation  for  inferential 
reasoning. The  PODM  will  be  used  to  perform  the  iterative 
construction  that  extends  the  Terrorist  Ontology  to  incorporate 
uncertainty,  creating  the  TIDPO. 

3)  Ontological  Engineering .  An  ontology  is  used  to  cap  tuie 
consensual  knowledge  about  a  domain  of  interest  [8].  Selection 
of  the  appropriate  ontological  engineering  methodology  is 
context  dependent  as  is  the  required  fidelity  of  the  ontological 
model.  Terms  and  processes  for  development  are  as  various  as 
the  application  for  which  they  are  used.  A  generalized  sequence 
of  steps  iteratively  modeled  for  ontological  engineering  is 
proposed  below  in  Figure  3. 


T able  3  -  T able  of  Selected  Metrics 


Requirement 

Metric 

ID 

Name 

ID 

Name 

Definition 

Units 

R1 

Terrorist  Individual 

Ml 

Model  Accuracy 

Correctly  identify  the  likelihood  (>  85%) 

Percent 

R2 

Background 

R3 

R4 

Relationships 

Associations 

M2 

Model  Flexibility 

Ingest/operate  on  ontology  of  172  i  ndividuals 

Items 

R5 

Communications 

R6 

Perform  a  nee 

M3 

ExecutionTime 

Generate  solution  in  2  minutes  or  less 

Min 

R6 

Perform  a  nee 

M4 

Model  Efficiency 

Compute  solutionon  pccomputer (Intel  1.3GHz) 

Processor 

T  able  4  -  Formal  Axioms  and  Rules 


[  Axiom 

Nationality 

Names 

Communication 

Terrorist 

Description 

Each  i ndividual  is 
associated  with  a  single 
nation 

Each  i ndividual  is 
known  bya  single 

na  me 

A  terrorist  will 
communicate  with 
ce  rta  i  nty 

There  is  a  possibility 
thatanyindividualin 
demographic  is  a 
terrorist 

Expression 

NA 

NA 

P(communicate)=  1.0 

P(Terrorist)  =  0.001 

Classes 

Person 

Nation 

Person 

Pe  rs  o  n 

Pe  rs  o  n 

Relations 

hasNationality 

has  Name 

NA 

NA 

Variables 

NA 

NA 

ComWithTerrorist 

isTerrorist 

Ontological  Engineering  Process 

i.  Identify  Classes: 
i.  Develop  Context: 

i.  Identify  Relationships: 

/.  Identify  States: 


what  objects  are  acting  or  acted  upon  ? 
where  or  when  are  the  actions  occurring  ? 
what  objects  are  affected  by  an  object? 
in  what  condition  may  an  object  be  found? 


Figure  3  -  Ontological  Engineering  Process 


Ontological  engineering  ensures  the  development  of  an 
explicit,  logical  and  defensible  ontologies  for  knowledge - 
sharing  and  reuse  that  will  be  extended  to  become  the  TIDPO. 

4)  Ontological  Learning .  There  are  several  methods  to  aid 
in  the  knowledge  acquisition  process  required  to  build  an 
ontology.  Ontological  Learning  was  not  employed  in  the 
TIDPO  instantiation. 

5)  Probabilistic  Learning.  For  the  TIDPO  model,  local 
probability  distribution  (LPD)  values  are  given  by  the  domain 
research  conducted  by  Sageman.  However,  probabilistic 
learning  would  be  a  means  to  incorporate  data  from  additional 
individuals  for  an  extended  knowledge  base. 

6)  Ontology.  The  Terrorist  Identification  Ontology  is 
created  in  OWL  using  Protege.  The  working  ontology  serves  as 
the  relational  framework  for  the  PO  when  uncertainty  is 
introduced.  Construction  tools  and  environments  such  as 
Protege  [10]  aid  in  the  key  ontological  engineering  tasks  of 
implementation,  consistency  checking,  and  documentation.  At 
this  point  the  ontology  is  implemented  in  a  suitable  ontology 
building  environment  and  evaluated  for  consistency.  For  this 
project,  the  Protege  (Version  4.1)  ontology  development 
environment  is  used  to  capture  terrorist  identification  domain 
information  [10]. 


C.  Support  Layer 

The  Support  Layer  provides  the  background  technology  and 
design  strategy  necessary  to  instantiate  the  conceptualization  of 
a  specific  probabilistic  ontology  to  satisfy  identified 
requirements.  It  includes  existing  ontologies  available  for  reuse 
or  re-engineering,  software  tools  that  enable  ontology  and 
probabilistic  ontology  development,  mathematical  languages 
that  allow  representation  of  entity  attributes  and  their 
relationships,  and  databases  of  existing  facts  referenced  for 
learning  and  knowledge  base  population.  The  purpose  of  the 
Support  Layer  is  to  facilitate  probabilistic  ontology 
development  by  identifying  technological  and  semantic 
features  specific  to  a  particular  inferential  reasoning  model.  The 
four  Support  Layer  components  are  discussed  below. 

1)  Existing  Ontologies.  Existing  ontologies  were  available 
for  reuse  as  shown  in  Table  5. 


Table  5  -  Existing  Ontologies 


Ontology 

Utility 

geopolitical.owl 

Nations,  groups,  neigh bors 

Generations. owl 

Fa  mily  relationships 

Biography.owl 

Individual  personal  data 

As  previously  discussed  in  Section  II.B.l,  model  reuse  is  a 
strength  of  the  ontological  engineering  discipline  and  effort 


should  be  made  to  research  and  incorporate  existing  ontology 
material  into  new  application  areas. 

2)  Modeling  Languages.  Ontological  engineering  was 
conducted  in  the  Web  Ontology  Language  (OWL)  due  to  its 
incorporation  within  Protege  and UnBBayes  software  tools.  All 
of  the  existing  ontologies  used  were  modeled  in  OWL.  Multi- 
Entity  Bayesian  Networks  (MEBN)  was  used  for  probabilistic 
ontology  development  due  to  the  maturity  of  available  software 
tools,  specifically  UnBBayes. 

3)  Software  Tools.  While  there  are  several  software  tools 
available  for  ontological  engineering,  at  this  time  only 
UnBBayes  is  mature  enough  to  produce  working  probabilistic 
ontologies.  UnBBayes  ingests  an  OWL  ontology  and  extends  it 
to  account  for  uncertainty.  Therefore,  Protege  is  used  to  captuie 
the  OWL  ontology  and  UnBBayes  for  the  probabilistic 
ontology. 

4)  Knowledge  Base.  The  knowledge  captured  in  the 
Terrorist  Ontology  is  primarily  gleaned  from  the  work  of 
Sageman  [3].  It  includes  data  about  172  terrorists  and  includes 
information  about  their  geographical  origins,  socioeconomic 
status, education,  faith,  occupation,  family  status,  psychology, 
age,  employment,  friendship,  kinship,  discipleship,  social 
network,  etc. 

III.  CONCLUSION 

A.  Summary 

Since  the  terrorist  attacks  of  September  11,  2001,  there  has 
been  a  great  deal  of  interest  in  expeditious  determination  of  the 
composition,  operations  and  resourcing  of  terrorist  networks. 
In  the  information  technology  domain,  much  of  the  focus  has 
been  on  mining  open-source  material  such  as  email,  weblogs, 
and  news  articles  to  build  a  representation  of  terrorist  social, 
resource,  and  operational  networks.  A  Decision  Support 
System  that  combines  information  about  relations,  group 
affiliations,  communications,  and  ethno-religious  or  political 
background  into  a  model  describing  the  likelihood  that  a 
particular  individual  becomes  a  terrorist  will  provide  the 
intelligence  analyst  with  a  powerful  tool  to  prioritize  limited 
investigative  resources.  The  architectural  introduced  in  this 
paper  provides  a  blueprint  to  develop  the  probabilistic  ontology 
needed  to  support  this  tool  through  inferential  reasoning. 

B.  Future  Work 

Continuation  of  this  work  will  include  instantiation  of  the 
probabilistic  ontology  and  eventual  testing  against  the  personal 
profiles  of  the  known  9/11  terrorists.  Using  the  classes, 
relationships,  and  probabilities  identified  by  Sageman  [3],  the 
terrorist  ontology  will  be  instantiated  and  uncertainty  applied 
by  extending  the  model  introduced  in  [2]  and  following  the 
Probabilistic  Ontology  Development  Methodology  [6].  This 
working  probabilistic  ontology  will  be  evaluated  by 


instantiating  evidence  statements  for  each  of  the  19  terrorists 

associated  with  the  attack  on  September  11,  2001. 
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Probabilistic  Ontology  Architecture 
for  a  Terrorist  Identification 
Decision  Support  System 


EMSolutions 


Background 


EMSolutions 


2 


Why  Probabilistic  Ontologies? 


Suppose  an  ontology  of  organisms  contains 
the  following  classes  and  relationships: 


Mammal 


isA 


Human 


isComposedOf 


p 


\ 


Digits 


Limbs 


•  Humans  usually  have: 
-  2  arms  &  2  legs 


-  1 0  fingers  &  1 0  toes 

•  However,  if  a  man  loses  a  limb.... 

-  Is  he  no  longer  human? 

EMSolutions 


Premise  of  an  argument  can  be 
uncertain  (e.g.  Humans  have  2  legs): 
(in)validity  of  the  argument  imposes 
no  condition  on  the  certainty  of  the 
conclusion  (an  amputee  is  Human). 


Uncertainty  Ontology 


A  probabilistic  ontology  is  an  explicit,  formal  representation  of 
knowledge  about  a  domain  of  application.  This  includes 

-  Types  of  entities  that  exist  in  the  domain; 

-  Properties  of  those  entities; 

-  Relationships  among  entities; 

_  -  Processes  and  events  that  happen  with  those  entities; 

-  Statistical  regularities  that  characterize  the  domain; 

-  Inconclusive,  ambiguous,  incomplete,  unreliable,  and 
dissonant  knowledge  related  to  entities  of  the  domain; 

-  Uncertainty  about  all  the  above  forms  of  knowledge; 

where  the  term  entity  refers  to  any  concept  that  can  be 
described  and  reasoned  about  within  the  domain  of 

application  [Costa,  2005]. 

An  ontology  is  an  explicit  specification  of  a  conceptualization  [Gruber,  95]. 

A  probabilistic  ontology  extends  a  traditional  ontology  to  represent  uncertainty. 


•  A  systematic  approach  to  probabilistic  ontology  development 

-  Facilitated  through  a  reference  architecture 

•  Formalizes  the  application  of  the  methodology 

•  Extensible  to  various  domains 

•  Reference  Architecture  for  Probabilistic  Ontology  Development  (RAPOD) 

-  A  generalized  reference  architecture  designed  to  collect,  catalogue,  and 
define  the  components  required  for  development  of  probabilistic  ontologies 
and  establish  the  criteria  to  be  satisfied  by  any  set  of  selected  tools  and 
methods 


RAPOD  provides  a  flexible  solution 


•  Provides  a  blueprint  for  architects  to  develop  specific 
solution  architectures  within  a  defined  domain. 

-  Template  for  development 

-  Defines  integral  components  and  their  relationships 

-  Reduces  development  time  and  project  risk 

•  Standardizes  language  among  participants 

•  Provides  consistency  of  development  within  a  domain 

•  Provides  a  reference  for  evaluation 

•  Establishes  specifications  and  patterns 


[A  Reference  Architecture  is]  an  authoritative  source  of  information  about  a 
specific  subject  area  that  guides  and  constrains  the  instantiations  of  multiple 
architectures  and  solutions  [Oasd/nii,  201  o].” 


•  Provides  synergy  of  effort  within  the  ST  community 

-  Identifies  concepts,  processes,  languages,  theories  and  tools 

-  Synergizes  effort  of  probabilists,  logicians,  decision  analysts, 
computer  scientists 


•  Spans  knowledge,  processes,  models  and  tools  necessary 
to  engineer  POs  at  a  high  level  of  abstraction 

•  Output  defines  a  domain  specific  architecture  that  may  be 
used  to  produce  probabilistic  ontologies  in  similar  domain 
contexts 


RAPOD  output  is  an  architecture 


The  RAPOD  in  Probabilistic  Ontology  Development 


Architecture  for  the  Terrorist  Identification 
Probabilistic  Ontology  (TIDPO) 
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Terrorist  Identification  PO  Concept 


Objective 


Concept  Diagram 


Develop  a  DSS  that  assists 
in  determining  if  an 
individual  is  associated  with 
terrorism. 


“A  DSS  is  a  system  under  control  of 
one  or  more  decision  makers  that 
assists  in  the  activity  of  decision  making 
by  providing  an  organized  set  of  tools 
intended  to  impose  structure  on  portions 
of  the  decision-making  situation  and  to 
improve  the  ultimate  effectiveness  of 
the  decision  outcome  [Marakas,  2003].” 


Architecture  for  Terrorist  Identification 
Probabilistic  Ontology 
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“Understanding 
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Operational  Probabilistic  Ontology  Implementation 


Architecture  for  Terrorist  Identification 
Probabilistic  Ontology 
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Objectives 

(Table  1} 


Requirements 

(Table  2) 
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Rules  & 
Axioms 
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